CVE-2023-35005: Apache Airflow: Information disclosure on configuration view
First published: Mon Jun 19 2023(Updated: )
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow | >=2.5.0<2.6.2 | |
| pip/apache-airflow | >=2.5.0<2.6.2rc1 | 2.6.2rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/airflow/pull/31788
- https://github.com/apache/airflow/pull/31820
- https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd
- https://nvd.nist.gov/vuln/detail/CVE-2023-35005
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-89.yaml
- https://github.com/apache/airflow/commit/5679a01919ac9d5153e858f8b1390cbc7915f148
- https://github.com/apache/airflow/commit/f6cda8fb63250fc4700658999739c1c3c5f6625c
- https://github.com/advisories/GHSA-mjff-wv85-hmcj (Advisory)
Frequently Asked Questions
What is CVE-2023-35005?
CVE-2023-35005 is a vulnerability in Apache Airflow that allows potentially sensitive values to be shown to users in certain situations.
How does this vulnerability affect Apache Airflow?
This vulnerability affects Apache Airflow versions 2.5.0 to 2.6.2.
What is the severity of CVE-2023-35005?
The severity of CVE-2023-35005 is medium (CVSS score of 6.5).
How is this vulnerability mitigated?
This vulnerability is mitigated by the fact that the configuration is not shown in the user interface by default, and not all uncensored values are affected.
How do I fix CVE-2023-35005?
To fix CVE-2023-35005, upgrade to a version of Apache Airflow that is not affected (2.6.3 or later).
- collector/nvd-index
- agent/type
- agent/weakness
- agent/title
- agent/remedy
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-mjff-wv85-hmcj
- alias/CVE-2023-35005
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/apache
- canonical/apache airflow
- version/apache airflow/2.5.0
- package-manager/pip